乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-05-17: 细节已通知厂商并且等待厂商处理中 2014-05-19: 厂商已经确认,细节仅向厂商公开 2014-05-22: 细节向第三方安全合作伙伴开放 2014-07-13: 细节向核心白帽子及相关领域专家公开 2014-07-23: 细节向普通白帽子公开 2014-08-02: 细节向实习白帽子公开 2014-08-15: 细节向公众公开
大汉版通某系统某个文件越权+SQL注入
#1 漏洞文件/xxgk/workflow/design/que_model.jsp(该目录下多个文件越权访问)
该文件多个参数存在SQL注入漏洞,代码如下
<% //判断权限 String userid = Convert.getParameter(request, "userid"); //当前页数 String currpage = Convert.getParameter(request, "currpage"); currpage = (currpage.equals("")) ? "1" : currpage; //条件// StringBuffer strSqlCondition = new StringBuffer(128); String que_classid = Convert.getParameter(request,"que_classid"); String que_classname = Convert.getParameter(request,"que_classname"); String que_keywords = Convert.getParameter(request, "que_keywords"); String que_keywords1 = Convert.getParameter(request, "que_keywords1"); que_keywords = ( que_keywords1.length() > 0 ) ? que_keywords1 : que_keywords; String b_valid = Convert.getParameter(request,"b_valid"); String b_child = Convert.getParameter(request,"b_child"); String starttime = Convert.getParameter(request,"starttime"); String endtime = Convert.getParameter(request,"endtime"); String strBillStatus = Convert.getParameter(request,"strBillStatus"); //删除后返回,刷新页面时不需要考虑是否有子流程 if(strBillStatus.equals("R")){ b_child = ""; } strSqlCondition.append(" 1=1 "); if (que_keywords.length() > 0) { strSqlCondition.append(" AND a.vc_modelname like '%" + que_keywords + "%'"); } if(que_classid.length()>0){ strSqlCondition.append(" AND a.vc_classid = '"+que_classid+"' "); } if(b_valid.length()>0){ strSqlCondition.append(" AND a.b_valid = "+b_valid); } if(b_child.length()>0){ strSqlCondition.append(" AND a.b_child = "+b_child); } if(starttime.length()>0){ strSqlCondition.append(" AND a.dt_createtime >= '"+starttime+" 00:00:00'"); } if(endtime.length()>0){ strSqlCondition.append(" AND a.dt_createtime <= '"+endtime+" 23:59:59'"); } strSqlCondition.append(" ORDER BY a.vc_code DESC");//...}
下面几个参数好像均存在注入
String que_classid = Convert.getParameter(request,"que_classid");String que_classname = Convert.getParameter(request,"que_classname");String que_keywords = Convert.getParameter(request, "que_keywords");String que_keywords1 = Convert.getParameter(request, "que_keywords1");que_keywords = ( que_keywords1.length() > 0 ) ? que_keywords1 : que_keywords;String b_valid = Convert.getParameter(request,"b_valid"); String b_child = Convert.getParameter(request,"b_child"); String starttime = Convert.getParameter(request,"starttime"); String endtime = Convert.getParameter(request,"endtime"); String strBillStatus = Convert.getParameter(request,"strBillStatus");
可以看出均没有任何过滤便进入了数据库...由于这个注入漏洞的形成比较简单,就不多说,下面直接漏洞测试..#2 采用sqlmap进行测试由于网上有大量的实例,任意选取一个案例进行测试验证..案例为:
http://xxgk.weifang.gov.cn/xxgk/workflow/design/que_model.jsp?que_keywords=&userid=1&que_classid=1&que_classname=1&que_keywords1=1&b_valid=1&b_child=2
sqlmap跑起来效果如图所示(这里仅测试一个参数)
过滤吧
危害等级:高
漏洞Rank:20
确认时间:2014-05-19 10:01
感谢关注
暂无